基于范式语法的工控协议Fuzzing测试技术  

Form-syntax based Fuzzing method for industrial control protocols

作　　者：张亚丰[1] 洪征[1] 吴礼发[1] 康红凯 孙贺[1] 

机构地区：[1]解放军理工大学指挥信息系统学院,南京210007

出　　处：《计算机应用研究》2016年第8期2433-2439,共7页Application Research of Computers

基　　金：国家自然科学基金资助项目(611032253);江苏省自然科学基金资助项目(BK2011115)

摘　　要：针对工控协议Fuzzing测试存在测试脚本编写工作量大、测试用例的覆盖面小、测试效率低等问题,提出了一种基于范式语法的工控协议Fuzzing测试方法。首先以改进的扩展巴科斯范式(modified augmented Backus-Naur form,MABNF)来描述工控协议;然后根据范式语法模型,将报文样本解析为范式语法变异树,进而生成范式语法变异树的描述脚本;提出了基于MABNF变异树的测试用例生成算法(MABNF-mutation-tree based testcases generating method,MTGM),先对MABNF变异树进行深度优先遍历,再采用语义变异策略对节点实施变异;最后利用MTGM得到冗余少、有效性高的测试用例集。使用该方法,实现了基于Peach的工控协议Fuzzing测试原型系统M-Peach,对供水SCADA系统进行了测试。与Peach的对比实验表明,所提出的方法能有效减少测试冗余,提高测试用例集的覆盖面和测试效率。Traditional fuzzing methods for the industrial control system have the shortcomings of heavy workload in writing scripts, small coverage of test cases and low efficiency in fuzz-testing. This paper proposed a new fuzzing method based on the form-syntax for the industrial control protocols. Firstly, it used MABNF to describe the industrial control protocols. Secondly, according to the description, it parsed the message samples into the form-syntax mutation tree structures, and generated the scripts of form-syntax mutation tree automatically. Lastly, it used the MTGM algorithm, which performed depth first traversal on MABNF-mutation-tree and then applied the semantic mutation strategy to the tree nodes, so as to reduce redundancy and generate more effective test cases. Using this method, it implemented the fuzzing tool M-Peach for the industrial control proto- col based on Peach platform, and performed experiments on a water supply SCADA system. Experimental results show that, comparing with Peach, M-Peach can effectively reduce redundancy, increase the coverage of test cases and improve testing ef- ficiency.

关 键 词：工控协议 模糊测试 范式语法 漏洞挖掘 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]